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RE: Anonymous Romania 


On 12 April 2012, the FBI received information that members of Anonymous in Romania 
hacked the website for the Romanian Minister of European Foreign Affairs, www.efthance.ro. 
The group responsible identifies themselves as “Malsec.” The group has the following twitter 
account: @malsec. 
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Yours truly, b7C 


Federal Bureau of Investigation 
Legal Attache 


By: 
Assistant Legal Attache 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it and 
its contents are not to be distributed outside your agency. 
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Title: (0/5956) CyWatch SitRep: Reported MALSEC Hacktivist activity, [|| ] 
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Synopsis: (0/9993 CyWatch providea| —— | 


of reported hacktivist activity by MALSEC. CyWatch will continue 
to coordinate with trusted partners and pass information as it becomes 
available. 


** 


UNCLASSIFIED/ AFeve- 


b7E 


(UFOS) Based on current reporting, no further action is needed. However, CyWatch will share 
information with CyD as it becomes available. 


Background: 


(U/FOUO) USCYBERCOM reported this information to CyWad| — ] 
CyWatch 
prog ы 


b7C 
Approved For Dissemination By: 
SSA 


From: CYWATCH 


Subject: CyWatch SitRep: MALSEC Hactivist activity reported by DC3 


Situation: 


(ueso | Defense Cyber Crime Center / Defense Cyber Investigative Coordination 
Center (DC3 / DCISE) sent an email to the NTOC reporting MALSEC Hackers may have found links to 
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b7C 


(UFOS) According to USCYBERCOM, the servers noted do not m to have been compromised, 


but the attackers continue discussion of attempted access to 


Action: 
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Synopsis:  (U//esSe9 CyWatch provided update 

regarding reported MALSEC Hacktivist Activity. CyWatch will continue to 
coordinate with trusted partners and pass information as it becomes 
available. 
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Subject: CyWatch SitRep: MALSEC Hactivist activity reported by DC3 
Situation: 
efense Cyber Crime Center / Defense Cyber Investigative Coordination 
b7E 
(Г/ЯҒӨНӨ) According to USCYBERCOM, the servers noted do not appear to have been compromised, 
but the attackers continue discussion of attempted access ae ae 
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(U/F OC) Based on current reporting, no further action is needed. However, CyWatch will share 
information with CyD as it becomes available. 


Background: 


(U/?FOUO9) USCYBERCOM reported this information to сум] 

CyWatch 

[ E 
b7C 


Approved For Dissemination By: 
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Subject: RE: CyWatch SitRep: MALSEC Hactivist activity reported by DC3 


Please note tha 
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Title: (U/APese> CyWatch SitRep: Reported CNA Activity by Hacktivist 


Aj : b3 
pproved By: A/UC ов 


b7C 


Synopsis: (0/0565 CyWatch provided notificatiof |] 


of reported CNA Activity by the Hacktivist Group MALSEC. CyWatch 
will continue to coordinate with trusted partners and pass information 
as it becomes available. 
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UNCLASSIFIED//Feve- 


b7E 


(UFOS) Based on current reporting, no further action is needed. However, CyWatch will share 
information with CyD as it becomes available. 


Background: 
(U/FOUO) USCYBERCOM reported this information to CyWad| | 


CyWatch 
[o >s 


b7C 


Approved For Dissemination By: 
SSA 


From: CYWATCH 
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Subject: CyWatch SitRep: MALSEC Hactivist activity reported by DC3 
Situation: 
(U/ Defense Cyber Crime Center / Defense Cyber Investigative Coordination 
sent an email to the NTOC reporting MALSEC Hackers may have found links to 
b7E 
(С>ЖӨБӘ)Ҙ According to USC YBERCOM, the servers noted do not appear to have been compromised, 
but the attackers continue discussion of attempted access et re 
Action: 
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Date of transcription 05/11/2012 


b6 
b7C 


was interviewed on Friday, May 
11, 2012 in Seattle, WA. Atter being advised of the identi 
the interviewing Agent and the nature of the interview, 


provided the following iriformation: : 
РА е 


eithef 2010 or 2011 in response to а DDOS attack 
initiated against the online moniker 


MALICIOUS SECURITY (MALSEC), a 
This infórmation was being furnished by 


1 


splinter group of ANTISEC. 


MALSEC 


MALSEC is 
operates from and is believed to a b6 
safer alternative to: bécause users can connect b7C 
using | E b7E 
Investigation on 5 / 1 1/2 012 at Seattle , WA | A еу. 


Fie # | | Date dictated п/а UG. 
by | | | ь7с 
; b7E 
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This document contains neither recommendations пот conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 


it and its contents are not to be distributed outside your agency. 
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